Understanding Cyber War Exclusions in Insurance 

With cyberattacks on the rise and becoming more frequent and severe, business owners are turning to cyber insurance as a form of protection. However, what many don’t know is that many of these policies now include a “cyber war exclusion,” which is a clause that denies coverage for cyberattacks considered acts of war. This, inevitably, leaves many businesses vulnerable to significant financial losses.  

There are many key issues with Cyber War Exclusions, explained below:

Attribution Challenges

It’s not the easiest task to figure out the culprit behind a cyberattack. A piece of evidence is often a requirement by the insurers, to ensure that a nation-state was involved, leading to a delay in claims, which are often denied as well.  

Complex Definitions

Again, it is quite complex to determine what qualifies as a “warlike” act, which can often lead to disputes between businesses and insurers. 

Impact on Coverage

Likely, your policy may not cover the losses if your business is victim to a major attack that is connected to a nation-state.  

While these are the key issues with Cyber War Exclusions, it’s also important to note the factors that are considered by the insurers, when deciding whether to apply a cyber war exclusion.  

First and foremost, it is considered whether there is any official declaration of war between countries, without which, it would become difficult to classify the event as an act of war. Secondly, the severity of the cyberattack also plays a crucial role. Therefore, the question arises – was it a small-scale attack or a massive disruption? Additionally, if the attack seems to be a part of a military strategy causing widespread harm, it is likely to be considered a warlike act. Lastly, Insurers also look at where the cyberattack originated and how far its effects were significant. This can help determine the motives behind the attack. 

A clear example of this theory is the 2017 NotPetya Ransomware attack, which caused $1.4 billion in damages for Merck & Co. The claim was denied, as insurers argued that it was rather an act of war by Russia. However, the courts later ruled in favor of Merck, since the policy did not exclude cyberattacks.  

As a business owner, you must ensure to understand the actual scope of your cyber insurance coverage and clearly understand the policy exclusions. If not, you could be subjected to sensitive situations causing significant financial loss. Collaborating with expert insurance advisors would also help you navigate these issues a lot better, as they hold significant experience and knowledge over these matters. And to take measures yourself, ensure that you invest in strong cybersecurity measures to mitigate these risks.  

If you’re looking for expert guidance on cyber insurance that could fulfill your business needs, feel free to get in touch with us. 

Our priority is safety and security for every business. 

For expert advice, contact Shayne Bevilacqua at Professional Liability Insurance Group.  
Call or Text us at +1 (877) PLIG – 123, That’s (877) 754 – 4123.